Runtime font download from untrusted URLs with no integrity check

[AshayK003]

Problem

pdf.py:39-52 downloads DejaVu font ZIPs from hardcoded URLs using urllib.request.urlopen(). No checksum verification, no certificate pinning.

Solution

Bundle fonts in the repo or ship them as a package asset. If download is necessary, verify SHA-256 checksums.

Acceptance Criteria

• Fonts are verified or bundled
• No network dependency for PDF generation

Difficulty: Medium